{"id":"CVE-2026-129139","kind":"vulnerability","aliases":["CVE-2026-129139"],"related":[],"title":"paicoding: predictable ZSXQ-login passwords let attackers take over accounts","description":"paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.","summary":"paicoding derives both the username and password of accounts created through ZSXQ login solely from the member's ZSXQ number. An unauthenticated attacker who reads that number from a victim's public profile page can compute the credentials and log in as the victim.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"paicoding","fixed":[],"affected":">= b8206b97cc504b939ca6fdc46e0a8c3e816b14e9, <= 903adce70309d340f7eec51ec3c80cfe3c8326c1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","paicoding","self-hosted","zsxq-login"],"not_affected_if":["no-zsxq-login","outside-commit-range"],"how_to_check":"Check whether your paicoding checkout contains commits b8206b9 through 903adce and LoginServiceImpl.loginByZsxq. Then list accounts created via ZSXQ login: their username and password derive only from the ZSXQ number shown on the public /user/{userId} page.","fix":"No fix published as of 2026-11-13; upstream issue #137 is open. Until then, disable ZSXQ login and reset passwords of accounts created via ZSXQ.","status":"open","published_at":"2026-11-13T18:17:38+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","triaged_at":"2026-11-13T18:51:20+00:00","updated_at":"2026-11-13T18:54:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T18:51:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"paicoding: predictable ZSXQ-login passwords let attackers take over accounts","impact":"high","summary":"paicoding derives both the username and password of accounts created through ZSXQ login solely from the member's ZSXQ number. An unauthenticated attacker who reads that number from a victim's public profile page can compute the credentials and log in as the victim.","audience":"businesses","category":"package","nicknames":[],"who_cares":["paicoding","zsxq-login","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as any ZSXQ-created account holder","analyst_note":"Confirm the fixed commit or version and whether a patch exists; check the vulncheck advisory for remediation details.","how_to_check":"- Check whether the project is paicoding and whether its git history includes commits between b8206b9 and 903adce, or whether the ZSXQ login (`loginByZsxq`) is present in the deployed code.\n- Look for accounts created through ZSXQ login and confirm their usernames are derived from ZSXQ numbers.","plain_action":"","product_name":"paicoding","needs_analyst":true,"not_affected_if":["no-zsxq-login","outside-commit-range"],"who_is_affected":"Deployments of paicoding built from commit b8206b9 through commit 903adce that use the ZSXQ login flow are exposed, because the username and password for those accounts are derived only from a number visible on each user's profile page. Deployments that do not use ZSXQ login, or that run outside this commit range, are not affected according to the sources. The sources do not say whether a fixed version exists.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000775,"input_tokens":4599,"output_tokens":630,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed commit or version and whether a patch exists; check the vulncheck advisory for remediation details.","search":"'-129139':14A,17A '-2026':13A,16A '/login/username':123C '/user':112C '903adce':77C 'account':11A,35B,82C,128C 'attack':8A,49B,103C 'b8206b9':74C 'commit':73C,76C 'comput':62B,116C 'creat':36B,83C 'credenti':64B,80C,118C 'cve':12A,15A 'deriv':28B,89C 'host':23B 'let':7A 'log':66B,120C 'login':5A,26B,39B,86C 'loginbyzsxq':88C 'member':43B,98C 'number':46B,53B,101C,107C 'packag':19B 'page':60B,115C 'paicod':1A,20B,27B,71C 'paicoding':18A 'password':6A,33B,94C 'predict':2A,79C 'profil':59B,114C 'public':58B 'read':51B,105C 'self':22B 'self-host':21B 'sole':40B,95C 'take':9A,125C 'unauthent':48B,102C 'use':78C 'userid':113C 'usernam':31B,92C 'via':84C,122C 'victim':56B,70B,110C 'zsxq':4A,25B,38B,45B,85C,100C 'zsxq-login':3A,24B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted paicoding deployments with ZSXQ login enabled, built from commits b8206b9 through 903adce. Anyone can read a member's ZSXQ number from the public profile page, compute the credentials and log in at /login/username. Deployments without ZSXQ login or accounts can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["paicoding"],"ptokens":["paicoding"],"labels":["high","package","paicoding","selfhosted","vendor","zsxqlogin"],"campaign_type":null,"search_a":"'-129139':14A,17A '-2026':13A,16A 'account':11A 'attack':8A 'cve':12A,15A 'let':7A 'login':5A 'paicod':1A 'paicoding':18A 'password':6A 'predict':2A 'take':9A 'zsxq':4A 'zsxq-login':3A","search_b":"'account':35B 'attack':49B 'comput':62B 'creat':36B 'credenti':64B 'deriv':28B 'host':23B 'log':66B 'login':26B,39B 'member':43B 'number':46B,53B 'packag':19B 'page':60B 'paicod':20B,27B 'password':33B 'profil':59B 'public':58B 'read':51B 'self':22B 'self-host':21B 'sole':40B 'unauthent':48B 'usernam':31B 'victim':56B,70B 'zsxq':25B,38B,45B 'zsxq-login':24B","search_c":"'/login/username':123C '/user':112C '903adce':77C 'account':82C,128C 'attack':103C 'b8206b9':74C 'commit':73C,76C 'comput':116C 'creat':83C 'credenti':80C,118C 'deriv':89C 'log':120C 'login':86C 'loginbyzsxq':88C 'member':98C 'number':101C,107C 'page':115C 'paicod':71C 'password':94C 'predict':79C 'profil':114C 'read':105C 'sole':95C 'take':125C 'unauthent':102C 'use':78C 'userid':113C 'usernam':92C 'via':84C,122C 'victim':110C 'zsxq':85C,100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129139","severity":null,"published_at":"2026-11-13T18:17:38+00:00","modified_at":"2026-11-13T18:17:38+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129139:3926","url":"https://github.com/itwanger/paicoding/issues/137","severity":null,"published_at":"2026-11-13T18:54:39+00:00","modified_at":"2026-11-13T18:54:39+00:00","first_seen_at":"2026-11-13T18:54:39+00:00","fetched_at":"2026-11-13T18:54:39+00:00","note":"VulnCheck advisory read (third-party CNA, not vendor). Upstream issue #137 still open as of 2026-11-13, no fix commit or release found. Affects commits b8206b9..903adce.","cites":["https://github.com/itwanger/paicoding/issues/137"]}],"documents":[{"id":148603,"url":"https://www.vulncheck.com/advisories/paicoding-commit-b8206b9-through-903adce-predictable-zsxq-account-credentials","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":148675,"url":"https://github.com/itwanger/paicoding/issues/137","title":"paicoding #137 [SECURITY] 7 vulnerabilities (open, no fix)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}